Add npm release workflow with provenance#9
Merged
teallarson merged 3 commits intomainfrom Mar 4, 2026
Merged
Conversation
better-auth v1.5.x split the Drizzle adapter into a separate peer dependency (@better-auth/drizzle-adapter). Add it explicitly and bump better-auth to ^1.5.3 in both ai-sdk and mastra templates to fix the Module not found build error. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename package to @arcadeai/create-agent with create-agent bin - Add publishConfig, repository, and homepage fields to package.json - Add .github/workflows/release.yml: tag-triggered publish to npm with OIDC provenance (Trusted Publishers) and GitHub Release creation - Document release process in CLAUDE.md and README.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sdserranog
reviewed
Mar 4, 2026
|
|
||
| ### One-time setup (must be done before first release) | ||
|
|
||
| 1. **Bootstrap the package on npm** — the package must exist before Trusted Publishers can be configured: |
Contributor
There was a problem hiding this comment.
I think we should omit this. This is something no one else will do ever again
sdserranog
reviewed
Mar 4, 2026
| npm audit signatures # verify provenance attestation | ||
| ``` | ||
|
|
||
| **First-time / one-time setup:** Before the workflow can publish, the package must exist on npm and npm Trusted Publishers must be configured. See [`CLAUDE.md`](./CLAUDE.md) for the full one-time setup instructions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@arcadeai/create-agentwithcreate-agentbin.github/workflows/release.yml: tag-triggered, publishes to npm with OIDC provenance (Trusted Publishers — no stored NPM_TOKEN needed) and creates a GitHub ReleaseCLAUDE.mdandREADME.mdHow releases work
Nothing publishes on merge to
main. To release:```bash
npm version patch # or minor/major
git push origin main --follow-tags
```
Pushing the
v*tag fires the workflow → npm publish with provenance → GitHub Release created.One-time setup needed before first release
ArcadeAI/create-arcade-agent, workflowrelease.yml, environmentnpmnpmGitHub Environment for approval gatesFull instructions in
CLAUDE.md.🤖 Generated with Claude Code